Teaching and Learning Cybersecurity Using Capture the Flag: Effectiveness Comparison Between University Students in Finland and Czechia

Abstract

In today's society, the demand for cybersecurity experts is increasing, as digital information systems are widely spread and targeted by malicious actors. This means that cybersecurity education should be effective in increasing students' knowledge, skills, self-efficacy, and the ability to adapt and apply knowledge in rapidly evolving situations. Offering hands-on training with real-world-like scenarios and exercises, for example, in the form of Capture the Flag (CTF) games, is one component in teaching students the needed skills. In this study, we measure and compare the effectiveness of cybersecurity teaching with the gamified CTF scenario in the Brno University of Technology Cyber Arena (BUTCA). We measure the effectiveness of the CTF scenario with pre- and post-surveys among university students in Finland and Czechia, and examine effectiveness among different student groups. We also study student satisfaction and the perceived meaningfulness of the learning for different scenario elements, such as instructions, tasks, and gamification elements. The CTFs increased knowledge and skill variables, self-efficacy variables, and interest variables. CTFs can have positive effects on learning-related variables despite varying student's base skills or level of knowledge, but different types of students may benefit in different ways. Student satisfaction and perceived meaningfulness of learning with CTF were also high across different student groups.